Anthropic has acknowledged that Claude Code included an experimental mechanism that detected whether a user environment was linked to China and then inserted hidden markers into system prompts. Claude Code engineer Thariq said the feature was introduced in March 2026, and after public scrutiny the company moved to remove it, with a full rollback planned for version 2.1.197.
According to Thariq’s explanation and the reported code details, the mechanism checked three signals: whether the system time zone was set to Asia/Shanghai or Asia/Urumqi, whether a proxy hostname matched a list of China-related resellers, and whether certain AI lab keywords were present. Instead of exposing that result directly, Claude Code encoded it into the system prompt through punctuation changes and Unicode-based steganography.
Date separators and apostrophes were used as hidden markers
The reported implementation altered the line reading “Today’s date is” inside the system prompt. If a China-based time zone was detected, the date separator changed from a hyphen “-” to a slash “/”, turning 2026-06-30 into 2026/06/30. The apostrophe in “Today’s date” could also switch among several nearly identical Unicode characters with different encodings, allowing the server to distinguish whether the proxy matched a China-linked domain, whether a Chinese AI lab reference was triggered, or whether both conditions were met.
Those edits were effectively invisible to ordinary users, while remaining machine-readable on Anthropic’s side. The source material says the behavior appeared in versions 2.1.193 through 2.1.196, with similar logic traceable back to version 2.1.91 in early April.
Anthropic framed it as anti-distillation, critics called it undisclosed tracking
Thariq said the purpose was defensive: to stop unauthorized resellers from abusing accounts and to reduce model distillation. He added that stronger protections had since been deployed, that the team had already planned to remove the mechanism, and that the relevant PR had been merged ahead of the rollback release.
The source also notes that Anthropic, OpenAI, and Google disclosed industrial-scale model distillation attacks in February 2026. Anthropic specifically accused DeepSeek, Moonshot AI, and MiniMax of using more than 24,000 fraudulent accounts and generating over 16 million conversations to train competing models.
The sharpest criticism focused on disclosure. Security account @IntCyberDigest published two code screenshots on June 30, prompting wider attention to the fact that users had not been informed. Thariq’s statement confirmed the mechanism and intensified debate over the timeline: launched in March, accelerated for removal only after exposure. Much of the community reaction centered on that gap, arguing that a company known for its safety messaging had deployed the feature without telling users.